PT-2022-20951 · Unknown · Kity Minder

Zer0Yu · Published 2022-06-09 · Updated 2022-06-15 · CVE-2022-31830

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Kity Minder version 1.3.5

Description The issue is related to a Server-Side Request Forgery (SSRF) that was discovered in Kity Minder. This SSRF occurs via the init function at ImageCapture.class.php.

Recommendations For Kity Minder version 1.3.5, consider restricting access to the init function in ImageCapture.class.php to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-31830

GHSA-Q56H-X9H5-Q53C

Affected Products

Kity Minder

References · 6

• 🔥 https://github.com/fex-team/kityminder/issues/345 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-31830 · Security Note
• https://osv.dev/vulnerability/GHSA-q56h-x9h5-q53c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31830 · Vendor Advisory
• https://github.com/fex-team/kityminder · Note
• https://t.me/cibsecurity/44100 · Telegram Post